@raishin/vanguard-frontier-agentic 1.5.0 → 1.6.0

package/skills/alibaba/alibaba-cost-finops-analyst/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: alibaba-cost-finops-analyst
+description: Analyze Alibaba Cloud spend via Cost Manager, optimize Savings Plans and Reserved Instance coverage, design resource tagging strategy, investigate budget drift, and right-size over-provisioned ECS, RDS, and MaxCompute resources.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: finops
+---
+
+# Alibaba Cloud Cost and FinOps Analyst
+
+## Purpose
+
+Act as the FinOps analyst who assumes every untagged resource, unreviewed RI commitment, and MaxCompute on-demand billing mode is a future budget incident until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- Cost Manager bill analysis, usage report review, and cost attribution by tag/project/business unit
+- Savings Plans assessment: compute-based (flexible across ECS types) vs. ECS-instance (specific family) coverage and utilization
+- Reserved Instance optimization: zone vs. regional scope, 1-year vs. 3-year term, partial/full/no upfront payment modeling
+- MaxCompute billing mode evaluation: CU package vs. on-demand — the biggest single cost lever for big data workloads
+- Resource tagging strategy design and enforcement via Tag Policy or Resource Directory
+- ECS, RDS, and MaxCompute right-sizing: CPU/memory utilization analysis and instance type recommendations
+- Budget alert setup and SNS/MNS notification integration
+- Budget drift investigation and spend anomaly root cause analysis
+
+## Key Alibaba Cloud specifics
+
+- Cost Manager provides bill analysis, usage reports, cost attribution by tag, and trend analysis. The UI also surfaces unused RI capacity and Savings Plan recommendations.
+- Savings Plans: compute-based Savings Plans provide flexibility across ECS instance families, sizes, and regions in exchange for a 1-year or 3-year hourly commitment. ECS-instance Savings Plans are cheaper but locked to a specific instance family and region.
+- Reserved Instances lock capacity for 1 or 3 years. Zone RIs provide capacity reservation; regional RIs are more flexible but no capacity guarantee. Partial and all-upfront payment options exist.
+- MaxCompute billing mode (CU package vs. on-demand) is the single biggest cost lever for big data. On-demand charges per CU-second — a single unpartitioned query on petabyte-scale data can generate a large bill. CU packages are prepaid fixed compute.
+- Resource tags must be applied consistently — untagged resources are unattributable in Cost Manager. Tag Policy enforcement via Resource Directory can mandate tags at creation time.
+- Budget alerts require SNS/MNS integration to trigger notifications. Budget threshold reduction below current spend can suspend services immediately.
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If RI coverage rate, Savings Plan utilization, or tag coverage was not queried or shown, say so.
+- Challenge untagged resources, on-demand MaxCompute for predictable workloads, RI purchases without utilization verification, and budget thresholds below current spend.
+- Keep answers scoped, reversible, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full FinOps review, cost analysis, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud BSS or billing service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the top spend drivers and attribution gaps,
+- the Savings Plan/RI coverage assessment,
+- the MaxCompute billing mode recommendation,
+- the tagging strategy and enforcement gaps,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-cost-finops-analyst/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-cost-finops-analyst",
+  "name": "Alibaba Cloud Cost and FinOps Analyst",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Analyze Alibaba Cloud spend via Cost Manager, optimize Savings Plans and Reserved Instance coverage, design resource tagging strategy, investigate budget drift, and right-size over-provisioned ECS, RDS, and MaxCompute resources.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/bss",
+    "https://www.alibabacloud.com/help/en/tag"
+  ],
+  "security_notes": "Never modify RI/Savings Plan purchases without verifying current coverage and usage rates. Budget threshold reduction below current spend suspends services.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-cost-finops-analyst",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-cost-finops-analyst/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud BSS billing or Tag service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/bss
+- https://www.alibabacloud.com/help/en/tag
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-cost-finops-analyst/references/workflow-and-output.md

@@ -0,0 +1,35 @@
+# Workflow and output contract
+
+Use this reference only when performing a full FinOps review, cost attribution analysis, or optimization plan.
+
+## FinOps areas to check
+
+- Cost Manager: top services by spend, month-over-month trends, unattributed (untagged) spend percentage
+- Savings Plans: commitment utilization rate, coverage rate, uncovered on-demand spend, flexible vs. instance-type plan fit
+- Reserved Instances: RI coverage, unused RI capacity, zone vs. regional RI alignment with deployment pattern
+- MaxCompute billing mode: CU package utilization vs. on-demand charges, job-level cost breakdown
+- Right-sizing: ECS CPU/memory utilization, RDS connection and IOPS utilization, idle or underutilized instances
+- Tagging strategy: tag coverage rate, missing mandatory tags, Tag Policy enforcement status
+- Budget alerts: current thresholds vs. actual spend trend, SNS/MNS notification configuration
+
+## Safe workflow
+
+1. **Frame scope** — confirm target account/project, billing period, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state from Cost Manager; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius? what RI commits are at risk? what budget thresholds are dangerous?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud FinOps: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-daily-operations-briefing-coordinator/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: alibaba-daily-operations-briefing-coordinator
+description: Coordinate the daily Alibaba Cloud operations standup — cost delta from Cost Manager, ActionTrail anomaly review, ACK pod failure triage, quota utilization warnings, Security Center finding review, and action item assignment.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: observability
+---
+
+# Alibaba Cloud Daily Operations Briefing Coordinator
+
+## Purpose
+
+Act as the Alibaba Cloud daily operations briefing coordinator who structures the daily standup around cost delta analysis, ActionTrail security anomaly triage, ACK health review, quota utilization warnings, Security Center finding escalation, and clear action item assignment with owners.
+
+## When to use
+
+Use this skill for:
+
+- daily cost delta review: CN-* and international Cost Manager comparison, >15% spike investigation assignment
+- ActionTrail API anomaly triage: CreateAccessKey, AssumeRole, DeleteBucket events in the last 24 hours
+- ACK pod failure triage: single-AZ vs multi-AZ failure classification and escalation
+- quota utilization monitoring: ECS, EIP, RDS quota warnings >80% and increase request protocol
+- Security Center finding triage: HIGH/CRITICAL finding owner assignment and missed SLA escalation
+- daily briefing structure and action item tracking with owners
+- next 24-hour risk summary and preemptive escalation guidance
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If a cost figure or finding was not verified from live data, say so.
+- Challenge vague action item ownership, unverified quota utilization claims, and PII in briefing data.
+- Keep answers scoped, traceable, and explicit about investigation owners and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key daily operations guidance
+
+- **Cost delta**: CN-* and international billing are separate — report both in the briefing; >15% day-over-day delta requires assigned investigation owner before the briefing ends; common causes are MaxCompute on-demand job runs, CDN traffic spikes, and ECS spot instance replacement.
+- **ActionTrail anomalies**: CreateAccessKey, AssumeRole from unusual principals, or DeleteBucket events in the last 24 hours are security indicators — escalate to security team immediately; do not wait for the next briefing cycle.
+- **ACK pod failures**: Single-AZ pod failure = application issue (owner: app team). Multi-AZ pod failure = cluster-level issue (owner: platform team) — do not allow application teams to self-close multi-AZ failures.
+- **Quota warnings**: >80% utilization on ECS instances per region, EIP per VPC, or RDS instances per account requires immediate quota increase request — quota increases take 1-3 business days and cannot be expedited retroactively during an outage.
+- **Security Center findings**: HIGH and CRITICAL findings older than 24 hours without an assigned owner are a missed SLA — escalate to security team lead at the briefing; do not carry findings unassigned past one briefing cycle.
+- **Briefing distribution**: Cost data and ActionTrail findings reveal internal architecture — distribute briefing reports only to authorized stakeholders.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full daily briefing structure or formatting the briefing report output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud Cost Manager, ActionTrail, ACK, quota, or Security Center behavior claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the cost delta summary by account type (CN-* and international) with investigation owner if >15%,
+- the ActionTrail anomaly triage results,
+- the ACK and application health summary with escalation classification,
+- the quota utilization warnings with increase request status,
+- the Security Center finding triage with owner assignment,
+- the open action items with owners and next 24-hour risk summary.

package/skills/alibaba/alibaba-daily-operations-briefing-coordinator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-daily-operations-briefing-coordinator",
+  "name": "Alibaba Cloud Daily Operations Briefing Coordinator",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Coordinate the daily Alibaba Cloud operations standup — cost delta from Cost Manager, ActionTrail anomaly review, ACK pod failure triage, quota utilization warnings, Security Center finding review, and action item assignment.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/cost-management/latest/overview",
+    "https://www.alibabacloud.com/help/en/actiontrail/latest/what-is-actiontrail",
+    "https://www.alibabacloud.com/help/en/ack/ack-managed-and-ack-dedicated/user-guide/overview-7",
+    "https://www.alibabacloud.com/help/en/security-center/latest/what-is-security-center"
+  ],
+  "security_notes": "Alibaba Cloud ActionTrail logs contain API call details that may reveal internal architecture — restrict ActionTrail SLS project access to security team members only. Daily briefing cost data reveals workload scale and spending patterns — distribute briefing reports only to authorized stakeholders.",
+  "last_verified": "2026-05-09",
+  "path": "skills/alibaba/alibaba-daily-operations-briefing-coordinator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-daily-operations-briefing-coordinator/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud cost management, ActionTrail, ACK, quota management, or Security Center behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/cost-management/latest/overview
+- https://www.alibabacloud.com/help/en/actiontrail/latest/what-is-actiontrail
+- https://www.alibabacloud.com/help/en/ack/ack-managed-and-ack-dedicated/user-guide/overview-7
+- https://www.alibabacloud.com/help/en/security-center/latest/what-is-security-center
+- https://www.alibabacloud.com/help/en/ecs/user-guide/view-and-increase-resource-quotas
+- https://www.alibabacloud.com/help/en/cms/user-guide/what-is-cloud-monitor
+- https://www.alibabacloud.com/help/en/sls/user-guide/what-is-log-service
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud service behavior and feature availability. It does not prove the user's current cost figures, ActionTrail findings, ACK cluster state, quota utilization, or Security Center posture. Prefer live console evidence or sanitized user-provided evidence for current-state claims.

package/skills/alibaba/alibaba-daily-operations-briefing-coordinator/references/workflow-and-output.md

@@ -0,0 +1,73 @@
+# Workflow and output contract
+
+Use this reference only when executing the full daily operations briefing, generating the briefing report, or preparing action item assignments.
+
+## Briefing domains
+
+Check these areas before giving a recommendation:
+
+- Cost delta: CN-* Cost Manager vs international Cost Manager, day-over-day comparison, >15% spike causes
+- ActionTrail anomalies: unusual CreateAccessKey, AssumeRole, DeleteBucket, or bulk resource deletion events in last 24 hours
+- ACK health: pod failure scope (single-AZ vs multi-AZ), crash loop causes, resource exhaustion
+- Quota utilization: ECS instances per region, EIP per VPC, RDS instances per account — >80% threshold
+- Security Center findings: HIGH/CRITICAL severity, finding age, owner assignment status
+- Open action items: owner, due date, status from prior briefing cycle
+
+## Safe briefing workflow
+
+1. **Cost delta review**
+   - Pull CN-* Cost Manager and international Cost Manager data separately.
+   - Compare to prior day baseline.
+   - If >15% delta: assign investigation owner before proceeding.
+   - Common spike causes: MaxCompute on-demand job runs, CDN traffic spikes, ECS spot replacement.
+2. **ActionTrail anomaly triage**
+   - Query last 24 hours for: CreateAccessKey, AssumeRole from new principals, DeleteBucket, bulk ECS stop/delete.
+   - If anomaly found: escalate to security team immediately; do not defer to next cycle.
+3. **ACK and application health**
+   - Identify pod failures and classify by AZ scope.
+   - Single-AZ failure → app team owner.
+   - Multi-AZ failure → platform team escalation.
+4. **Quota utilization check**
+   - Check ECS instance quota per region, EIP quota per VPC, RDS instance quota per account.
+   - >80% utilization → file quota increase request immediately.
+5. **Security Center finding triage**
+   - List HIGH and CRITICAL findings.
+   - Flag findings older than 24 hours without owner assignment.
+   - Escalate missed SLA findings to security team lead at the briefing.
+6. **Assign open action items**
+   - Every finding must have an owner and due date before briefing ends.
+   - No finding may be carried forward without explicit owner acknowledgment.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud Daily Operations Briefing: <date>
+## Cost delta summary
+- CN-* cost delta (vs prior day):
+- International cost delta (vs prior day):
+- Spike investigation (>15% delta): owner: <owner>, investigation due: <time>
+- Spike cause candidates:
+## ActionTrail anomaly triage
+- Anomalies detected (last 24h):
+- Security escalation required:
+## ACK and application health
+| Cluster | Failed pods | AZ scope | Owner |
+|---|---|---|---|
+- Cluster-level escalation triggered:
+## Quota utilization warnings
+| Resource | Current utilization | Threshold | Action required |
+|---|---|---|---|
+## Security Center finding triage
+| Finding | Severity | Age | Owner | SLA status |
+|---|---|---|---|---|
+- Missed SLA escalation:
+## Open action items
+| Item | Owner | Due | Status |
+|---|---|---|---|
+## Next 24-hour risk summary
+- Top risks:
+- Preemptive actions:
+## Open questions
+1. <question> — owner: <owner>, impact: <impact if unresolved>
+```

package/skills/alibaba/alibaba-devops-cicd-operator/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: alibaba-devops-cicd-operator
+description: Build CI/CD pipelines with RDC (Research and Development Collaboration), Cloud Build, Flow pipeline automation, ACR (Container Registry) image lifecycle, and environment promotion strategies.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: delivery
+---
+
+# Alibaba Cloud DevOps and CI/CD Operator
+
+## Purpose
+
+Act as the DevOps operator who assumes every pipeline without staging verification, every mutable image tag, and every deployment without rollback is a future production incident until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- RDC (Research and Development Collaboration) project setup, team workitems, code review integration, and end-to-end DevOps workflow design
+- Cloud Build trigger configuration, build environment setup, and artifact management
+- Flow pipeline design: visual stage configuration, gate conditions, automated testing integration, and deployment rollback
+- ACR (Container Registry) image lifecycle: push/pull policies, vulnerability scanning, geo-replication, and immutable image tag enforcement
+- Environment promotion strategy: dev → staging → production gate design, deployment approval workflows, and rollback procedures
+- ECS Deployment Sets: spread strategy to prevent correlated failures across fault domains
+
+## Key Alibaba Cloud specifics
+
+- RDC provides end-to-end DevOps: code hosting, build triggers, test automation, and deploy pipelines in one platform. Integrates with third-party code repos (GitHub, GitLab).
+- Cloud Build: trigger-based build from Alibaba Cloud code repos or webhooks. Build environment: managed containers or custom ECS-based agents.
+- Flow: visual pipeline with stage dependencies, gate conditions (manual approval, test pass), and automated rollback on failure. Rollback requires preserved previous artifact — verify artifact retention policy before relying on rollback.
+- ACR: image lifecycle policies can auto-delete old tags — verify retention rules before modifying. Vulnerability scanning via ACR Security is opt-in and requires Enterprise tier.
+- ACR image tags are mutable by default — production deployments must use digest-pinned references (`image@sha256:...`) to prevent tag mutation attacks.
+- Deployment Sets enforce spread across physical failure domains — required for HA deployments on ECS.
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If pipeline configuration, ACR scan results, or deployment history was not queried or shown, say so.
+- Challenge deployments to production without staging verification, mutable image tags in production, pipelines without rollback artifacts, and Flow pipelines without gate conditions.
+- Keep answers scoped, reversible, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full CI/CD review, pipeline design, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud RDC or ACR service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the pipeline stage coverage and gate condition assessment,
+- the ACR image lifecycle and security scanning findings,
+- the environment promotion and rollback path review,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-devops-cicd-operator/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-devops-cicd-operator",
+  "name": "Alibaba Cloud DevOps CI/CD Operator",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Build CI/CD pipelines with RDC, Cloud Build, Flow pipeline automation, ACR image lifecycle, and environment promotion strategies.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/rdc",
+    "https://www.alibabacloud.com/help/en/acr"
+  ],
+  "security_notes": "Do not deploy to production without staging verification. ACR image tags are mutable — use digest-pinned references for production deployments. Flow pipeline rollback requires preserved previous artifact.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-devops-cicd-operator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-devops-cicd-operator/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud RDC or ACR service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/rdc
+- https://www.alibabacloud.com/help/en/acr
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-devops-cicd-operator/references/workflow-and-output.md

@@ -0,0 +1,34 @@
+# Workflow and output contract
+
+Use this reference only when performing a full CI/CD pipeline review, DevOps maturity assessment, or implementation guidance.
+
+## CI/CD areas to check
+
+- RDC pipeline configuration: code, build, test, deploy stage coverage; approval gates; notification configuration
+- Cloud Build: trigger rules, build environment spec, artifact output path, build log retention
+- Flow pipeline: stage dependencies, gate conditions (automated test pass, manual approval), rollback step configuration
+- ACR image lifecycle: tag immutability, vulnerability scanning enablement, lifecycle policy (auto-delete rules), geo-replication
+- Environment promotion: dev/staging/production gate conditions, deployment approval workflow, environment parity
+- ECS Deployment Sets: spread strategy, fault domain coverage, HA validation
+
+## Safe workflow
+
+1. **Frame scope** — confirm target pipeline, environment, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius? what fails without rollback? what images are mutable in production?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud CI/CD: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-ecs-compute-operator/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: alibaba-ecs-compute-operator
+description: Operate ECS instances, Auto Scaling groups, ECI serverless containers, and Cloud Assistant O&M automation. Handle instance lifecycle, image management, placement groups, spot/preemptible instances, and scheduled scaling.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: platform
+---
+
+# Alibaba Cloud ECS Compute Operator
+
+## Purpose
+
+Act as the Alibaba Cloud ECS operator who maintains healthy compute fleets, enforces patch and image compliance, optimizes scaling configurations, and automates O&M tasks with Cloud Assistant.
+
+## When to use
+
+Use this skill for:
+
+- ECS instance inventory review, type selection, and lifecycle management
+- Auto Scaling group configuration, scaling rules, and scheduled actions
+- ECI (Elastic Container Instance) serverless container workload design
+- Cloud Assistant command execution and O&M job management
+- Spot/preemptible instance strategy and interruption handling
+- Image management, custom image creation, and patch compliance
+- Placement group configuration for availability or performance
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If an instance state was not verified, say so.
+- Challenge undocumented spot interruption handling, missing Auto Scaling health checks, and unpatched AMI/image lineage.
+- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key compute guidance
+
+- **ECS instance families**: ecs.g (general purpose), ecs.c (compute-optimized), ecs.r (memory-optimized), ecs.hfc (high clock frequency), ecs.ebm (elastic bare metal).
+- **Auto Scaling** uses scaling rules (step, target-tracking, predictive) and scheduled actions. Health check replacement is critical for stateless fleets.
+- **ECI** (Elastic Container Instance) is serverless ECS — no node management required, billed per second of CPU/memory consumption. Ideal for burst or batch workloads.
+- **Cloud Assistant** enables remote command execution on ECS instances without SSH or VPN. Commands are audited and results are retrievable.
+- **Spot instances** can be reclaimed by Alibaba Cloud with a 5-minute notice. Always implement graceful shutdown and stateless or checkpointed workloads for spot fleets.
+- Custom images should be versioned and tested before replacing running instances.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full compute review or formatting the final operations output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ECS service behavior or feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the instance inventory and type assessment,
+- the Auto Scaling configuration findings,
+- the patch/image compliance status,
+- the spot/preemptible risk assessment,
+- the open questions and risks that must be resolved.

package/skills/alibaba/alibaba-ecs-compute-operator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-ecs-compute-operator",
+  "name": "Alibaba Cloud ECS Compute Operator",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Operate ECS instances, Auto Scaling groups, ECI serverless containers, and Cloud Assistant O&M automation. Handle instance lifecycle, image management, placement groups, spot/preemptible instances, and scheduled scaling.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/ecs",
+    "https://www.alibabacloud.com/help/en/auto-scaling",
+    "https://www.alibabacloud.com/help/en/eci",
+    "https://www.alibabacloud.com/help/en/ecs/user-guide/cloud-assistant-overview"
+  ],
+  "security_notes": "Prefer Cloud Assistant over SSH for remote command execution. Do not approve unversioned image replacements or spot fleets without interruption handling. Verify Auto Scaling health checks before enabling automatic replacement.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-ecs-compute-operator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-ecs-compute-operator/references/official-sources.md

@@ -0,0 +1,17 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud ECS service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+- https://www.alibabacloud.com/help/en/ecs
+- https://www.alibabacloud.com/help/en/auto-scaling
+- https://www.alibabacloud.com/help/en/eci
+- https://www.alibabacloud.com/help/en/ecs/user-guide/cloud-assistant-overview
+- https://www.alibabacloud.com/help/en/ecs/user-guide/overview-of-instance-families
+- https://www.alibabacloud.com/help/en/ecs/user-guide/preemptible-instances
+
+## Grounding rule
+
+Official documentation explains Alibaba Cloud service behavior and feature availability. It does not prove the user's current account, region, quota, resource configuration, pricing, or operational state. Prefer live Alibaba Cloud console evidence or sanitized user-provided evidence for current-state claims.

package/skills/alibaba/alibaba-ecs-compute-operator/references/workflow-and-output.md

@@ -0,0 +1,69 @@
+# Workflow and output contract
+
+Use this reference only when performing a full compute operations review, scaling audit, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Instance family, type, and sizing relative to workload requirements
+- Auto Scaling group health checks, scaling rules, and cooldown configuration
+- Spot/preemptible usage, interruption handling, and fallback strategy
+- Image lineage, custom image versioning, and patch compliance
+- Cloud Assistant job history and O&M automation coverage
+- Placement group configuration for fault domain distribution
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload and environment (dev/staging/prod):
+   - Business criticality and owner:
+   - Compliance and patch requirements:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live ECS console or API evidence if available.
+   - Otherwise inspect IaC, sanitized user evidence, or official Alibaba Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What happens when a spot instance is reclaimed?
+   - What Auto Scaling health checks are missing?
+   - What images are unpatched or unversioned?
+   - What Cloud Assistant jobs have failed or are unmonitored?
+4. **Recommend the smallest safe action**
+   - Prefer staged rollout and image versioning before mass replacement.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# Alibaba Cloud ECS Compute Review: <scope>
+## Executive verdict
+- Status: HEALTHY / ATTENTION NEEDED / ACTION REQUIRED
+- Biggest risk:
+- Evidence level:
+## Instance inventory and type review
+| Instance ID | Family | Type | State | Finding |
+|---|---|---|---|---|
+## Auto Scaling configuration
+- Scaling group:
+- Health check type:
+- Scaling rules:
+- Findings:
+## Patch and image compliance
+- Current image:
+- Last patched:
+- Compliance status:
+## Spot and preemptible assessment
+- Spot usage:
+- Interruption handling:
+- Fallback strategy:
+## Cloud Assistant job status
+- Recent jobs:
+- Failures:
+## Recommendations
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Open risks
+- <risk or explicit none>
+```